start	end	text
1180	4340	Hello, everybody. Welcome to Lock Bypass Village.
4340	8020	My name is Karen, and today I'm going to be taking you through Bypass 101,
8020	10500	an introduction to basic bypass methods.
12780	15960	So, before we get started, what is bypass?
16340	20380	Very often, when people think about physical hacking, they think about show-your-methods,
20380	24020	things like lockpicking. However, there are plenty of other methods that can
24020	28620	allow people to access locked-out locations, and this is known collectively as lockbypass.
29460	32400	So, to get things started, I have a fun video here,
32400	36500	which is a really great example of lockbypass. It involves finding a security
36500	40400	vulnerability, exploiting it, and then gaining access to areas that should otherwise
40400	41720	be locked out.
45700	50460	This next video shows what can happen if your security system is poorly designed or poorly
50460	51500	thought out.
53940	59240	My mom wanted to lock her door. She's got a sliding door.
60560	62820	And this was her solution.
69580	71560	So, why bypass?
71820	75420	Lockbypass often involves ignoring the lock altogether and finding an
75420	79260	alternative way to open the door, and sometimes even avoiding having to use the door
79260	83260	altogether. Lockbypass methods are used often because they're
83260	87100	much faster and more reliable than lockpicking, and they're used much more frequently
87100	91240	in physical red teaming. So, as you can see here,
91240	95100	we have our agenda for today, and there are a lot of different types of bypass here.
95240	99060	In addition, the items that are in bold are available to play as
99060	103640	games on our website, bypassvillage.org, so feel free to go check those out.
104380	107580	So, let's get started with latch-targeted bypass.
108200	111040	Latch-targeted bypass, or carding, targets
111040	115220	the latches that hold the door closed. Depending on the orientation of the latch,
115220	119300	you can either shove or pull the latch. There's a variety of tools
119300	123740	that you can use for this. Most commonly, you'll see latch clips or traveler's hooks,
123740	126780	plastic cards, or even a well-bent piece of wire.
127900	131120	Circled here in red is what is known as a deadlatch.
131120	135840	When the deadlatch is pushed in, it prevents the latch from being pushed in as well.
136020	138840	This prevents you from being able to card a door.
141060	143460	Here's a quick video demonstration of how
143720	144920	a deadlatch works.
147200	151400	So as you can see, when the deadlatch is pushed in, you can no longer
151400	155260	get the latch into the door. Sometimes
155260	159400	the door is installed in such a way that the deadlatch is already in a hole in the strike
159400	163500	plate that is in the frame of the door. Other times,
163500	167480	the deadlatch is installed almost properly, but you can get it to fall into the hole
167480	171380	by shoving, pushing, maneuvering, or shaking the door.
172520	175520	This is a deadbolt. They're different from deadlatches,
175520	179300	and often you'll see them with a thumb turn on the other side. These prevent you
179300	183320	from being able to use latch-targeted bypass techniques, and it also prevents
183320	187540	you from using the under-the-door tool. So, the instructions
187540	191300	for use for pulling. So first you want to make sure that the deadlatch isn't
191300	195980	actuated. After that, you want to place the latch slip tool behind the latch.
196260	199460	You then want to wiggle the latch slip to move the latch slowly into
199460	203360	the door. And then, without removing the tool from holding in the latch,
203360	207020	you want to pull the door open. Here's a quick video demo
207020	209720	of how to do it.
213930	218330	So as you can see, the door is locked, and we take our bypass tool
218330	221630	and we put it behind the latch,
222710	226310	and then we slowly wiggle it back and forth, slowly moving
226310	230230	the latch into the hole in the door. And thus, it can be pulled
230230	234490	open. So what exactly
234490	238190	is happening here? Pretty much what the tool does is it
238190	242010	takes advantage of the fact that the latch is at an angle,
242010	246390	and it follows that angle to slowly push the latch into the hole
246390	247670	in the door.
250130	254190	So, for shoving. First, again, you want to ensure that the deadlatch is
254190	258290	not actuated. Once you've done that, you want to shove the shoving tool between
258290	262330	the latch and the strike plate. And then, without removing the tool from holding in
262330	266410	the latch, you want to pull the door open. Again, here's a quick video
266410	269710	demonstration of exactly how to do it.
270430	274110	So you can see he has the thin plastic card here,
274110	278230	and that the door is locked. You maneuver
278230	282570	the card between the door latch and the strike plate,
282570	284850	and you can push it open.
286710	288850	So, again, how exactly does this
288850	292830	work? Pretty much what you do is
292830	296830	you take this latch, and, again, you're taking advantage of the angle of the
296830	301170	latch. And this card slowly pushes the latch into the hole,
301170	303270	allowing the door to be pulled open.
306170	308810	So, again, here's a quick little visual
308810	312950	demonstration for you guys. Have you been curious about
312950	316990	wanting to try to make your own? We have several DIY Bypass Tools
316990	320930	workshops over the DEF CON weekend, so here's the information there, so be
320930	324730	sure to check that out. It'll be going over a variety of different physical
324730	328890	Red Team tools, and how to make them using things you probably already have at home.
329790	332930	In addition, there's also a game. We have a latch-slipping
332930	336890	game at BypassVillage.org. So it's an interactive game where you can latch-slip
336890	340890	doors, and there's varying levels of difficulty. Next, we'll
340890	344870	be discussing handle-targeted bypass. Sometimes the dead latch
344870	349450	is actuated, and the door absolutely cannot be carded. But there is still hope.
349450	352730	There does exist lock-bypass methods that target the handle of the door
352730	356870	instead of the latch. This method mimics a person exiting through the door from the other
356870	360850	side. So, the under-the-door tool allows
360850	364850	us to access areas that do have properly functioning dead latches.
364850	368290	This bypass method targets doors that have lever-type handles.
368990	372330	The tool itself is thick wire, about 5 feet long, with
372330	376350	string tied to the end. The tool is measured against the door handle and bent into
376490	380570	a hook shape at the top. As I mentioned before,
380570	384250	this bypass method targets doors that have lever-type handles.
384350	388890	In addition, you'll also need enough room under or beside the door to fit the tool.
389030	392410	As you can see here with different types of levers, S-type levers
392410	396530	and T-type levers are the easiest to use this bypass on, with U-type
396530	399390	and Q-types being much more challenging.
400150	403570	So, here's a quick video demonstration of how it's done.
442020	442500	And...
442500	444700	one more time, here's how it's done.
444700	449040	In this video, I'm going to show you how to use an under-the-door bypass tool.
449080	452600	They allow us to gain entry through doors with locked door handles.
453300	457040	First, the tool is slid through the gap between the door and the floor.
457040	461160	It is then maneuvered onto the inside door handle and pulled downwards, replicating
461160	464180	the motion of someone opening the door from the inside.
466760	468360	There you go, nice and easy.
468360	472300	So, step-by-step, what you want to do is you want to insert the tool under the
472300	476740	door, and then maneuver the tool until the top hook rests behind the door handle.
476760	480400	You then move the tool to the end of the handle and pull on the string, actuating
480400	484360	the lever. Again, I'm going to plug
484360	488380	our DIY bypass tools workshop. In the workshop, we will be covering
488380	492400	how to make this tool, and again, this will be using materials that you probably
492400	496900	already have at home. Alright, let's talk about doorknobs.
497620	499780	Doorknobs are often very difficult to bypass.
500160	504960	Thankfully, they're slowly being phased out of use, but you may still encounter some of them in the wild.
505460	508560	The tool for this bypass is a bent piece of wire, which is used to
508560	512420	deposit a piece of string onto the doorknob. Tape, rubber, or other
512420	515880	materials can be added to the string to help increase friction on the doorknob.
515880	520580	So, on this image, I have some tape. So here's the tool again,
520580	522420	but from slightly different angles.
524880	528600	And as you can see, the wire is meant to go around the frame and
528600	532580	have access to the front of the door. So, the
532580	536540	requirement for this bypass method is a doorknob, of course. And,
536540	540460	similar to the under-the-door tool, you also need enough room under or beside the door
540460	544440	to fit the tool. So, the instructions for use are very
544440	548820	simple. The tool is used to deposit this piece of string onto the doorknob,
548820	552800	at which point the wire piece is removed, and then the string is pulled
552800	556520	back and forth, creating tension, which slowly turns the doorknob.
557160	560060	So, here's a quick little video demo for you guys.
560660	564900	So, as you can kind of see, the tool is slowly being moved up the side of the
564900	569540	door, and the string has tape attached to it to increase the friction on the doorknob.
570340	572960	Once the tool is high enough, the string is
572960	576700	maneuvered so that it lands over the doorknob.
585190	587810	And then, both sides of the string are
587810	591630	pulled back and forth to create friction, which then unlocks the door.
595180	597120	Again, a little closer, you can see
597120	601120	the friction on the doorknob as it slowly turns.
603360	605280	Next is crash bars.
606680	609400	Crash bars, not to be confused with push bars, are
609400	613440	relatively simple in concept. The bar across the crash bar pushes down and
613440	617260	unlocks the door. The tool for this is very
617260	621440	similar to the under-the-door tool. The wire is cleverly bent and
621440	625140	with some string used to actuate the crash bar and unlock the door.
626440	629380	The requirements for this is a crash bar on the other side of the door
629380	632440	and, again, enough room beside the door to fit the tool.
633920	637320	So, to use this tool, you want to insert the tool through the side of the door,
637320	641460	or start at the bottom and move up depending on how much room you have on the side of the door,
641460	645920	and then rotate the hook until the hook lands on the crash bar. Once it's on the crash bar,
645920	649580	you can pull down the string, which pulls the crash bar towards the door and unlocks it from the
649580	653600	inside. So here's a quick demo video to demonstrate how
653600	661420	this tool works. So,
661420	665220	once I get it up the door frame, it hooks
665220	668480	onto the bar of the crash bar,
670080	673440	and then you can pull on the string, and it'll
673440	677840	open the door. So, again, step by step,
677840	681560	you want to get the tool into the side of the door and up,
681980	685440	and then once it's high enough, you hook it onto the
685440	689640	frame of the crash bar, and then you pull on the string, which pulls it towards
689640	693200	the door. Now let's talk about push bars.
693720	697560	Push bar-targeted bypasses tend to be more difficult due to there being less things
697560	701420	for tools to hook onto. Often, the best bypass for a push bar is a
701420	704360	latch-charging one, but this isn't always possible.
705300	709380	So, the tool for this bypass is a piece of string. Optional
709380	713920	is stiff wire or sticks for positioning the string, ideally in a hook or an L-shape.
714920	717340	For this bypass method to work, the push bar must
717340	721120	be either on a door with holes, or with room above and below the door.
722220	725360	Pretty much how this bypass works is you feed the string through the
725360	729300	top of the door or through a hole above the push bar, use the wire pieces to move
729300	733900	the string over the push bar and through the bottom of the door, or through a hole below the push bar,
733900	737220	and then you grab both pieces of the string and you pull. And this pulls
737220	741220	the push bar towards the door, thus actuating it as if someone
741220	744480	were exiting from inside, and unlocks the door.
745500	748640	This next bypass is pulling really hard.
749000	753380	So, pulling really hard is a long-standing tradition of physical hackers, and there
753380	757300	are a lot of doors that are loose in the frame and can be pulled open with a strong enough arm.
757820	761680	This is the easiest bypass method to pack for, all you need is a
761680	765620	reasonably strong pair of arms. So, not all doors
765620	769480	can be pulled open this way, but a surprising number of them can be. You want to look
769480	774400	for springy, loose-in-the-frame kind of doors that have an amount of flex when you pull on them.
774400	780000	Multibank doors often do have at least one door that is pullable.
780000	782800	So, here's the instructions for use.
782800	785480	Very complex, very difficult, so just feel free to take your time
785480	789540	going over that. The next bypass I'm going to be talking about
789540	793740	is removing the hinges. So, sometimes the easiest way to unlock a
793740	797800	door is to not unlock it at all. Some doors are installed with the hinges backwards,
797800	801980	which allow you to unscrew the door from the frame and take the door off the hinges.
801980	805800	The tool for this is obviously a screwdriver. For this to work,
805800	809840	the screws of the door hinges must be exposed and accessible.
809840	813540	And it's pretty self-explanatory how to do this. You unscrew the hinges, and then
813540	817640	you remove the door, and boom, you can enter. However, seeing hinges
817640	821460	installed like that are not very common. However,
821460	825500	doors that have the pin of the hinge exposed are very common. This pin
825500	829160	can be removed and then allow the door to once again come off of the frame.
829500	833400	The tool for this is a screwdriver or a nail, a hammer, and then
833400	837640	optional but recommended vice grips. For this to work, the door
837640	841480	must be an outward-swinging door with exposed hinges. And in addition,
841480	845300	this will not work on security hinges, so things like set screws or stud hinges.
846580	849440	So, how this works is if there is a decorative bottom
849440	853580	cap, you can remove it with a screwdriver and hammer, and then once you've done
853580	857840	that, you place the screwdriver under the hinge with the point touching the bottom of the hinge pin.
857980	861380	Then you can use your hammer to gently tap the screwdriver until the pin can be
861380	865460	pulled out. After you've finished that, you want to repeat that with the other hinge, and then you
865460	869680	can remove the door. Here's a quick little demo video for you guys.
873440	875000	So we gently tap it
875800	879400	to have the hinge pin come out of the hinge.
880700	883900	And once it's out enough, you can use the vice grips
883900	888240	to pull it out the rest of the way. And then again, you want to repeat this
888240	889860	with the other hinge pin.
893420	895920	And once it's out enough,
895920	898740	you want to take your vice grips and you can pull it out.
899520	902460	And now that both hinges have their hinge pins removed,
902460	907200	you can gently move the door out of the door frame.
908940	910920	And boom, you have entry.
914420	914920	Next,
914920	918800	let's talk about padlock shims. So, these are padlock shims, and they
918800	922700	can be bought online in plastic or metal versions. You can also make your own at
922700	926820	home using aluminum cans. So, this is how
927040	931120	a padlock works in normal operation, when you have a key and you're unlocking it.
932080	935220	Padlock shims take advantage of the mechanisms inside of padlocks
935220	938840	and force the mechanisms together that hold the shackle down,
938840	942820	allowing you to pull it open. Of course, this doesn't work on all padlocks, and there
942820	946820	are padlocks now that are designed to specifically prevent them from being used,
946820	950740	but you would be surprised at the number of padlocks that are still in use
950740	955020	that this can be used on. Again, I'm going to plug our DIY
955020	959020	Bypass Tools Workshop, and they'll be going over how to make
959020	962520	these and a lot of other tools as well, so drop by if you can.
963960	967620	Now, let's talk about bypassing button-push combination boxes.
968180	970940	So, button-push combination boxes allow access without
970940	975020	needing to have a physical key. There are also boxes that can contain keys inside
975020	979360	of them. I'm sure you've seen these before in communal spaces, apartments, things like that.
979360	983660	And I'm sure you've seen boxes like this outside of areas that have a lot of storefronts.
983660	987700	So these are used because when a company, an employer,
987700	991500	needs to provide access to a store for a whole bunch of people,
991500	995720	but doesn't want to create a key for every single person, what they'll do is they'll have one
995720	1000280	key, and they'll put it inside of this box, and then give each opening employee the combination.
1000560	1003640	Then, they can use the key to unlock the door, put it back, and leave it
1003640	1007660	for the next person to use. So, you can use UV
1007660	1011560	ink or powder, and you can use that to figure out which buttons are being used to
1011560	1015520	unlock the door. Using a UV light and a little bit of patience, you can reduce
1015520	1018680	the number of possible combinations enough that you can brute force it.
1019300	1023640	So, how you do this is you apply UV ink or powder to all of the buttons on the box,
1023640	1027480	and then you wait for the lock to be used a few times. As people use it, the ink
1027480	1032040	will rub off of the buttons. After a while, you can return with a UV light.
1032040	1035860	The buttons used to unlock the box will have less ink on them than the others.
1036200	1039760	Then, you can try all of the possible combinations with the inkless buttons.
1041040	1043880	In addition to that, depending on the UV ink or
1043880	1047700	powder that you use, it's possible for pigment to transfer from one button to another
1047700	1051740	when someone's unlocking the box. You can use this to figure out the combination order without
1051740	1055940	brute forcing the combination. And then, sometimes
1055940	1059200	you don't even need to use a UV light to figure out the combination if
1059760	1063240	anybody out there could guess how to unlock this lock.
1064180	1067920	In addition to that, these are simplex locks, and
1067920	1071940	when they come from the factory, their default code is pressing 2 and 4 at the same time
1071940	1076080	and then 3. Very frequently, people will not bother to set a new combination
1076080	1079920	and so there's a lot of simplex locks out there that still
1079920	1084060	use that default code. And there's a game
1084060	1088020	for it! So we've made a really, really cool button push combination lock game
1088020	1092060	and they have several different button push combination locks to try
1092060	1095720	out, and it's a really fun interactive game. You get UV
1095720	1100260	ink and UV light, and it's a really good time, so head over to bypassvillage.org
1100260	1103560	and go and try that out! Next, let's talk about
1103560	1107640	hacking EnterPhones. So I'm sure you've seen these around before, but EnterPhones are
1107640	1111800	devices that are used to let people into buildings, most commonly apartments, condos,
1111800	1115820	and high-rises of that sort. They allow visitors to contact someone that lives in the
1115820	1119820	building, who can then remotely unlock the door to let them in. There's a few
1119820	1123740	major companies that make EnterPhones, and they're often key-to-like,
1123740	1127620	meaning that one key can open all the EnterPhones made by the same company.
1129280	1131700	So, what you want to do is you want to open the
1131700	1136000	EnterPhone panel using the corresponding key, and you want to find the unlocking mechanism.
1136320	1139620	Once you've found the unlocking mechanism, you want to use something conductive to jump
1139620	1143720	through the mechanism. At that point, the door should unlock as if someone from inside buzzed
1143720	1147560	you in. So, here's a quick little video on an EnterPhone
1147560	1148300	bypass.
1148300	1148800	...
1162120	1165240	And, similar to the combination
1165240	1169160	boxes, there is a game for this as well. So, if you've always wanted to try your
1169160	1172840	hand at EnterPhone hacking, now's a really great opportunity to do so.
1174140	1177160	The next bypass method I'm going to be talking about is wheelchair
1177160	1181080	buttons and request exit sensors. So, wheelchair buttons
1181080	1185120	allow the door to automatically open when the button's pressed. Sometimes,
1185120	1189160	the button is installed so that it'll unlock and open the door, regardless of if the
1189160	1193180	door should be locked otherwise. So, I have this great little clip here for you
1193180	1197320	guys. So, as you see, the door is locked, but
1197320	1200880	with a push of the wheelchair button, it's open.
1202380	1204960	In addition to wheelchair buttons, there also exist
1204960	1209060	request exit sensors. So, these are installed for the convenience of people that are
1209060	1213060	inside exiting the building. Some are set up so that they automatically open
1213060	1216960	as you approach them from the inside, but some just unlock and allow the person
1216960	1221060	that's inside to exit the building. If you can trick the sensor into thinking that there's someone
1221060	1225220	inside that wants to exit, then it'll unlock itself, allowing you access.
1225560	1229140	So, here's a great clip from the YouTube channel WeHackPeople
1229140	1233060	where they pass the sensor using canned air.
1234060	1234500	...
1241350	1241790	...
1245310	1248130	Next, I'm going to be talking about elevators.
1248590	1252110	So, elevators are pretty much everywhere nowadays, and
1252110	1256030	very often in buildings and high-rises and things like that, there will be
1256030	1260270	floors that are locked out and require a keycard or a fob or something to get into,
1260270	1263970	whether that's through the stairway or through the elevator. Luckily, there are
1264070	1267930	a lot of ways to bypass these, and you can get to lockout floors through elevator hacking.
1268530	1272070	So, this is our elevator panel, and pretty much this is where we're going to be
1272070	1276090	spending a large part of our time. So, common keys.
1276090	1279670	A lot of elevator keys for various service modes are standardized, so
1279670	1283810	here's a list of some of the more common ones. I recommend you look into these
1283810	1287930	at your leisure. And these elevator keys can allow you to use special service
1287930	1291970	modes, so things such as independent service mode, inspection service mode, attendant service mode,
1291970	1296170	and fire service mode, which give you a lot more access privileges than you would
1296170	1300050	when it's running in normal service mode. In addition to
1300050	1304070	using common keys, you can also jumper and short the elevator panel. So,
1304070	1308030	electronics runoff of signals representing open and shorted, and if we can trick
1308030	1312670	this elevator into thinking that an open signal is being sent when it's not, or the other way around,
1312670	1316010	then we can get it to behave the way that we want it to. So, we accomplish
1316010	1319930	this by jumpering or shorting connections that are in the elevator panel. So,
1319930	1324230	to do this, you want to disconnect the panel, whether that's unscrewing it, coaxing it open, etc.,
1324230	1328090	and then you want to find the thing that you want to bypass. At this point,
1328090	1331970	it makes sense to identify the state of the mechanism. So, if the mechanism is open, then you
1331970	1336050	want to short it, and vice versa. So, to short it, you want to use something conductive,
1336050	1339870	whether that's wire, keys, alligator clips, anything of that sort, to connect both
1339870	1343970	terminals. If you want to open the circuit, then you want to disconnect the leads or snip
1343970	1347930	the wires. If you're unable to determine the state of the mechanism, then it is
1347930	1351910	safe to attempt both methods. So, again,
1351910	1355970	you want to take a look at it, and if your mechanism
1355970	1359990	is shorted, then you want to disconnect the leads or snip the wires. And then
1359990	1363990	if the mechanism is open, you want to short the mechanism by using something conductive to connect
1363990	1368030	both of the terminals. So, there's a game!
1368090	1371710	So, if you head over to bypassvillage.org, we have a nice little elevator
1371710	1376070	hacking game that you can try out, and you can learn a bit more about elevator
1376070	1380330	hacking in a safe environment. Another method
1380330	1383970	of bypass through elevators is hoistway access.
1384010	1387810	So, hoistway access, or getting on top of an elevator car and controlling it from there,
1387810	1392050	is another way that you can access locked out floors using an elevator. I'm not going to be
1392050	1396010	going more in depth for this today, because this talk is being recorded and put on the
1396010	1399850	internet, but if you come out to our elevator hacking talk next year at Bypass Village,
1399850	1403790	it will be covered. Next, let's talk about
1403790	1408150	unlocked or improperly locked doors. Now, this sounds like it'd be very obvious,
1408150	1411910	but you'd be surprised at the number of doors that are left unlocked or completely open.
1411950	1415810	There's plenty of times that you can access an area just by pulling on some doors and seeing which
1415810	1419890	ones are unlocked, especially in larger buildings, ones that have a lot of doors and a lot of
1419890	1423750	entrances. So, there's a lot of reasons why a door won't be locked,
1423750	1427910	whether it's human error, so something like a worker propping it open and forgetting to unprop it,
1427910	1431910	or someone leaving clutter at the door and that holds it open, or environmental,
1431910	1435870	so whether there's a warped door frame, or the lock is broken, or there's simply no
1435870	1440350	lock there at all, all of these can cause the door to not be locked.
1440590	1443650	So, here's a really great example of what appears to be
1444250	1447950	a lab, perhaps, of some sort, and someone seems to have propped the door open with
1448130	1451350	a stool, despite the sign saying, keep this door closed.
1452850	1456010	Here's another great example. So, this door seems
1456010	1459910	to have some sort of concrete at the base, and so this
1459910	1463730	prevents the door from closing at all, so this door is just
1463730	1467790	permanently open and permanently unlocked for anyone to stroll in.
1468210	1472370	Here's another example. There is simply no lock,
1472370	1475790	and, again, anyone can just pull open the door and just
1475790	1479810	walk in. Finally, let's talk about
1479810	1483890	ceilings, windows, and going around. So, here's
1484230	1487790	a clip from a while ago. We encounter this very large fence with
1487790	1491830	barbed wire on top and everything, but it
1491830	1495770	really didn't provide too much trouble. Like
1495770	1499790	I mentioned before, it's very easy to gain access to areas through windows,
1499790	1503530	especially if they're low to the ground. Here's a great example
1503530	1507750	of a bypass. This is a ladder with a ladder cage around
1507750	1511810	it, and if you look at the photo on the right, there is a ladder grate at
1511810	1515710	the bottom, and what this does is it prevents people from being able to climb
1515710	1519590	the ladder. Unfortunately, if you go around to the other
1519590	1523730	side of the ladder, there's plenty of space between the ladder and the wall, and you
1523730	1527730	can easily climb up it and get to wherever it is you want to go without
1527730	1531430	ever having to interact with the ladder cage or the grate.
1532570	1535910	In addition to that, you can always go through the ceiling.
1536390	1539950	So, a lot of places nowadays have false ceilings,
1539950	1543690	and very often the walls will not rise up past these false
1543690	1547650	ceilings, meaning that it's very easy to go from room to room or hallway
1547650	1551750	to room over the walls without ever having to interact with the
1551750	1555890	door. So here's a really great clip from a while back.
1556690	1559590	In this case, we were very fortunate that there was a ladder that
1559590	1563710	led up to a upper hatch, but we were able to take advantage
1563710	1568270	of this to gain access into a room next door.
1570010	1571630	So as you can see, he's
1571630	1575930	very, very carefully undoing the ceiling tile,
1575930	1579710	the holds that keep it there, moving it to the side, and there he
1579710	1583730	is. Now he has access to an area
1583730	1587530	that he otherwise shouldn't simply by going into the ceiling
1587530	1593110	and over the wall. So the thing to keep in mind
1593110	1596950	with this, though, is you want to be very, very careful. There's a lot of places
1596950	1601150	that you can't step or can't hold your weight, and when you're
1601150	1604810	up in a fragile area like that, one wrong move can
1604810	1607150	prove to be very dangerous.
1630450	1631430	So again,
1631430	1635170	you have to be very, very careful. You need to know where
1635170	1640030	you can and can't step and which areas can and can't support your weight.
1640050	1642350	So here's another great example.
1654790	1657790	So you just want to always be careful
1657790	1661750	whenever you're trying this kind of bypass method, or really any other type
1661750	1665490	of bypass method, or this could happen.
1666470	1669430	So that wraps up my presentation for today.
1669450	1673570	At this point, I'll be able to take some questions. Some big takeaways, come
1673570	1677550	try out some of our games at bypassvillage.org. We worked really, really
1677550	1681490	hard on them to make sure that they were available and ready for you guys to try out and get
1681490	1685330	that hands-on experience learning about physical bypass. And also come to the
1685330	1689770	DIY Bypass Tools Workshop. So we'll have a lot of tools being made,
1689770	1693510	it'll be a really fun time, it'll be using materials you probably already have at
1693510	1697870	home, so you might as well. And then you can also try these things out at home.
1698110	1701730	If you guys have any questions for me, we'll now be going into a Q&A
1701730	1705650	session, a live Q&A session. And if you missed that
1705650	1709430	and still have questions, feel free to send me an email or send me
1709430	1713570	tweets at Quineb or at Bypass Village.
1713730	1717670	Special thanks to Sunny, Ege, Bobby, Bill, and
1717670	1721330	Paul for all of your help with getting footage, putting together
1721330	1724910	photos, getting everything ready for this presentation.
1724990	1726170	Thank you so much guys!